1*647ac401Sbluhm#!/usr/local/bin/python3 23fe81ad4Sbluhm 3*647ac401Sbluhmprint("6 non-overlapping ping fragments in 75 seconds, timeout is 60") 43fe81ad4Sbluhm 53fe81ad4Sbluhm# |----| 63fe81ad4Sbluhm# |----| 73fe81ad4Sbluhm# |----| 83fe81ad4Sbluhm# |----| 93fe81ad4Sbluhm# |----| <--- timeout 103fe81ad4Sbluhm# |----| 113fe81ad4Sbluhm 123fe81ad4Sbluhmimport os 133fe81ad4Sbluhmfrom addr import * 143fe81ad4Sbluhmfrom scapy.all import * 153fe81ad4Sbluhm 163fe81ad4Sbluhmpid=os.getpid() 173fe81ad4Sbluhmeid=pid & 0xffff 18*647ac401Sbluhmpayload=b"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcd" 193fe81ad4Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 203fe81ad4Sbluhm ICMP(type='echo-request', id=eid)/payload 213fe81ad4Sbluhmfrag=[] 223fe81ad4Sbluhmfid=pid & 0xffff 233fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 24*647ac401Sbluhm flags='MF')/bytes(packet)[20:28]) 253fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 26*647ac401Sbluhm frag=1, flags='MF')/bytes(packet)[28:36]) 273fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 28*647ac401Sbluhm frag=2, flags='MF')/bytes(packet)[36:44]) 293fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 30*647ac401Sbluhm frag=3, flags='MF')/bytes(packet)[44:52]) 313fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 32*647ac401Sbluhm frag=4, flags='MF')/bytes(packet)[52:60]) 333fe81ad4Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 34*647ac401Sbluhm frag=5)/bytes(packet)[60:68]) 353fe81ad4Sbluhmeth=[] 363fe81ad4Sbluhmfor f in frag: 373fe81ad4Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 383fe81ad4Sbluhm 393fe81ad4Sbluhmif os.fork() == 0: 403fe81ad4Sbluhm time.sleep(1) 413fe81ad4Sbluhm for e in eth: 423fe81ad4Sbluhm sendp(e, iface=LOCAL_IF) 433fe81ad4Sbluhm time.sleep(15) 443fe81ad4Sbluhm os._exit(0) 453fe81ad4Sbluhm 463fe81ad4Sbluhmans=sniff(iface=LOCAL_IF, timeout=90, filter= 473fe81ad4Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 483fe81ad4Sbluhmfor a in ans: 493fe81ad4Sbluhm if a and a.type == ETH_P_IP and \ 503fe81ad4Sbluhm a.payload.proto == 1 and \ 513fe81ad4Sbluhm a.payload.frag == 0 and a.payload.flags == 0 and \ 523fe81ad4Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 533fe81ad4Sbluhm id=a.payload.payload.id 54*647ac401Sbluhm print("id=%#x" % (id)) 553fe81ad4Sbluhm if id != eid: 56*647ac401Sbluhm print("WRONG ECHO REPLY ID") 573fe81ad4Sbluhm exit(2) 583fe81ad4Sbluhm data=a.payload.payload.payload.load 59*647ac401Sbluhm print("payload=%s" % (data)) 603fe81ad4Sbluhm if data == payload: 61*647ac401Sbluhm print("ECHO REPLY") 623fe81ad4Sbluhm exit(1) 63*647ac401Sbluhm print("PAYLOAD!=%s" % (payload)) 643fe81ad4Sbluhm exit(1) 65*647ac401Sbluhmprint("no echo reply") 663fe81ad4Sbluhmexit(0) 67